CVE-2008-0870 — Link Following in Systems Weblogic Portal

CWE-59 — Link Following3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 47.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
BEA Systems Weblogic PortalOracle Weblogic Portal
Timeline
PublishedFeb 21
Latest updateMay 1

Description

BEA WebLogic Portal 10.0 and 9.2 through Maintenance Pack 2, under certain circumstances, can redirect a user from the https:// URI for the Portal Administration Console to an http URI, which allows remote attackers to sniff the session.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

Patches

Patch: dev2dev.bea.com ↗Patch: dev2dev.bea.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-xh4h-vjm3-wxmv: BEA WebLogic Portal 10↗2022-05-01
▶
CVEList
CVE-2008-0870: BEA WebLogic Portal 10↗2008-02-21
▶
CVE-2008-0870 — Link Following | cvebase